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DETAILED ACTION 

This Action is in regards to the Reply received on 29 November, 2004. 

Response to Amendment 

1 . This action is responsive to the applicant's argument filed on November 29 th , 
2004. Original claims 1-36 were not amended. Claims 37-50 are newly added. Claims 
1-50 are pending. Claims 1-50 represent a method and system for an "handling 
incoming mail messages." 



Response to Arguments 

2. Applicant's arguments with respect to independent claims 1 , 20, 24, and 26 have 
been carefully considered, but are not deemed fully persuasive. Furthermore, 
applicant's argument regarding new claims 37-50 have also been fully considered and 
are not persuasive. Applicant's arguments are deemed moot in view of the following 
new ground of rejection as explained here below, necessitated by Applicant substantial 
amendment (i.e., a method an apparatus wherein incoming electronic mail messages 
are being handled) to the claims which significantly affected the scope thereof. The 
dependent claims stand rejected as articulated in the First Office Action and all 
objections not addressed in Applicant's response are herein reiterated. 

In response to Applicant's arguments, 37 CFR § 1.1 1(c) requires applicant to 
"clearly point out the patentable novelty which he or she thinks the claims present in 
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view of the state of the art disclosed by the references cited or the objections made. He 
or she must show the amendments avoid such references or objections." 

The Examiner maintains the arguments presented in the first Office Action as 
outlined below and the rejection is therefore sustained. 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another 
filed in the United States before the invention by the applicant for patent or (2) a patent granted on an 
application for patent by another filed in the United States before the invention by the applicant for patent, 
except that an international application filed under the treaty defined in section 351 (a) shall have the effects 
for purposes of this subsection of an application filed in the United States only if the international application 
designated the United States and was published under Article 21 (2) of such treaty in the English language. 

4. Claims 1-10, 20-28, 30, 32-34, and 37-41 are rejected under 35 U.S.C. 102(e) 
as being unpatentable by Donaldson et al (Donaldson), U.S. 6,321 ,267 B1 . 

Donaldson teaches a method and a system to filter electronic junk mails wherein 
an IP filtering mechanism is provided to handle incoming mails in a mail server 
environment from a host. 

Regarding claim 1: Donaldson et al teach a method suitable for use in a 
communication device for determining the disposition of incoming e-mail from a sender 
(column 2, lines 37-41; fig. 1, items 1045-1048), said method comprising the steps of: 

establishing the identity of the sender to provide a sender identifier (column 6, 
lines 14-20; column 14, lines 63-67; fig. 14, items 1401-1406)] 

determining a cumulative penalty count value associated with said sender 
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identifier (column 23, lines 25-36; column 22, lines 25-33; fig. 16, items 1500-1518; note 
that the penalty count value here is the threshold number points or the matching count)] 

retrieving a system resource usage status associated with the communication 
device (column 6, lines 42-52)\ and 

processing the incoming e-mail on the basis of said cumulative penalty count 
value and said system resource usage status (column 22, lines 28-33; column 16, 12- 
64) 

Regarding claim 2: Donaldson et al teach the method of claim 1 wherein said 
step of establishing the identity of the sender comprises the step of ascertaining an IP 
address for the sender (column 6, lines 14-20). 

Regarding claim 3: Donaldson et al teach the method of claim 1 wherein said 
step of establishing the identity of the sender comprises the step of associating the 
sender with a peer IP address of the sender TCP connection (column 6, lines 42-52). 

Regarding claim 4: Donaldson et al teach the method of claim 1 wherein said 
step of determining a cumulative penalty count value comprises the step of assessing a 
penalty count value to said sender identifier for an undesirable activity associated with 
the sender (column 22, lines 23-33; note that the penalty count value here is the 
threshold number points and if the value of the match point exceeds the threshold, there 
is an undesirable activity associated with the remote host ). 
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Regarding claim 5: Donaldson et al teach the method of claim 4 wherein said 
cumulative penalty count value comprises an activity penalty count charged to the 
sender for current undesirable sender activity and a time-dependent penalty count 
determined from previous undesirable sender activity (column 22, lines 23-33; column 
5, lines 59-67; column 6, lines 1-2; note that attempting to send a copy of the message 
100 times suggest that the penalty count dependent on previous undesirable sender's 
activity). 

Regarding claim 6: Donaldson et al teach the method of claim 5 wherein said 
time-dependent penalty count comprises a zero value subsequent to a pre-established 
retention period (column 17, lines 59-64; note that if the result is zero, then the remote 
host matches the particular node filter). 

Regarding claim 7: Donaldson et al teach the method of claim 5 wherein said 
time-dependent penalty count comprises a prior activity penalty count value reduced by 
a decay factor (column 21, lines 12-56; note that the filter scans the node name of the 
remote host for certain sequences and adds or subtracts points). 

Regarding claim 8: Donaldson et al teach the method of claim 4 wherein said 
undesirable activity comprises a member of the group consisting of: sending a large 
number of e-mails (column 1, lines 14-20), sending e-mails of relatively large sizes 
(column 1, lines 17-19), using a relatively large amount of TCP connection time (column 
26, lines 1-11), and causing a TCP timeout (column 33, lines 20-23; Note the ^ 
appearance of the interrupted TCP connection). 
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Regarding claim 9: Donaldson et al teach the method of claim 1 wherein said 
system resource usage status is a function of a member of the group consisting of: the 
number of concurrent TCP connections being maintained (column 25, lines 59-64), the 
number of e-mail files in an incoming message queue, and the amount of disk space 
being utilized for an incoming message queue (column 5, lines 52-58; Donaldson et al 
disclose a message store and its mail queue that keeps undelivered messaged for up to 
a week). 

Regarding claim 10: Donaldson et al teach the method of claim 1 wherein said 
step of processing the incoming e-mail comprises the step of assigning an operating 
state to the communication device, said operating state being a function of said system 
resource usage status (column 16, lines 15-19; Donaldson et al disclose a proxy which 
deallocates resources and resets internal state variables). 

Regarding claim 20: Donaldson et al teach a communication device for 
determining the disposition of incoming e-mail from a sender, said device comprising: 
a penalty count filter module (fig. 13, item 1401) having 

means for identifying the sender (column 6, lines 14-20; column 14, lines 63-67); 

means for assigning a penalty count to the sender, said penalty count being a 
function of undesirable activity associated with the sender (column 8, lines 1-17)', 

means for determining a resource usage value for said communication device in 
receiving e-mail (column 16, lines 12-19)\ 
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means for specifying an operating state for said penalty count filter module, said 
operating state being a function of said resource usage value (column 16, lines 12-19); 
and 

an accept/reject filter for disposing of the incoming e-mail on the basis of said 
sender penalty count and said operating state (column 3, lines 43-45). 

Regarding claim 21 : Donaldson et al teach the method of claim 20 wherein 
said means for identifying the sender includes means for obtaining at least one of a 
Domain Name Service verification (column 12, lines 45-49) and a peer IP address of the 
sender TCP connection (fig. 14, item 1404; fig. 13, item 1470). 

Regarding claim 22: Donaldson et al teach the method of claim 20 wherein 
said undesirable activity comprises a member of the group consisting of: 

sending a large number of e-mails (column 1, lines 14-20), sending e-mails of 
relatively large sizes (column 1, lines 17-19), using a relatively large amount of TCP 
connection time (column 26, lines 1-11), and causing a TCP timeout (column 33, lines 
20-23; Note the occurrence of the interrupted TCP connection). 

Regarding claim 23: Donaldson et al teach the method of claim 20 wherein 
said system resource usage status is a function of a member of the group consisting of: 
the number of concurrent TCP connections being maintained (column 25, lines 59-64), 
the number of e-mail files in an incoming message queue, and the amount of disk space 
being utilized for an incoming message queue (column 5, lines 52-58; Donaldson et al 
disclose a message store and its mail queue that keeps undelivered messaged for up to 
a week). 
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Regarding claim 24: Donaldson et al teach a communication device for 
determining the disposition of incoming e-mail from a sender, said device comprising: 

a sender penalty count data structure for storing a current penalty count value 
associated with the sender (column 23, lines 25-36; fig. 16, items 1500-1518; note that 
the data structure is represented by table 4 in column 23 and that matching count 
represents the penalty count); 

a system resource usage status file for storing a current usage status value for 
device e-mail processing resources (column 17, lines 27-48; note that the system 
resource becomes unavailable for email processing once the proxy determines that the 
remote network has been placed in a blacklisted database)] and 

an accept/reject filter for disposing of the incoming e-mail on the basis of said 
penalty count value (column 3, lines 43-45) and said usage status (column 17, table 1, 
hostname values). 

Regarding claim 25: Donaldson et al teach a method claim 24 wherein said 
sender penalty count data structure includes an entry comprising a member of the 
group consisting of: 

a sender identification value (column 22, lines 40-44), 

a cumulative penalty count value (column 22, lines 46-49), 

a cumulative e-mail count (column 32, lines 41-45; note that the number of 
recipient here represents the number of emails), 

a total e-mail size (column 32, lines 45-48), 

a total TCP connection time (column 26, lines 9-11), and 
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a timestamp value (column 4, line 27). 

Regarding claim 26: Donaldson et al teach a method suitable for use in a 
communication device for determining the disposition of incoming e-mail from a sender, 
said method comprising the steps of: 

identifying the e-mail sender by determining a sender IP address (column 6, lines 
14-24)] 

obtaining a previous sender penalty count value calculated for said sender IP 
address (column 22, lines 40-49; note that the matching mechanism is used here as the 
penalty count and that the 32-bit address for the remote host is used to calculate the IP 
address of its 20 neighbors); and 

accepting or rejecting the incoming e-mail based on said sender penalty count 
value (column 3, lines 43-45) and said usage status (column 17, table 1, hostname 
values). 

Regarding claim 27: Donaldson et al teach the method of claim 26 further 
comprising the steps of: 

maintaining a behavior trace table entry for the e-mail sender (column 21-22, 
table 3); and 

determining said previous sender penalty count from said behavior trace table 
(column 21-22, table 3, offset value). 
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Regarding claim 28: Donaldson et al teach the method of claim 27 further 
comprising the step of updating sender behavior values in said trace table entry in 
response to receipt of a sender e-mail {column 17, lines 65-67; column 18, lines 1-7; 
fig. 14, item 1408; note that if the sender's IP address matches an entry in the blacklist 
database, the proxy server issues an error reply to the remote host, closes the 
connection, logs the rejected connection, and exits without any email being transferred). 

Regarding claim 30: Donaldson et al teach the method of claim 28 wherein said 
step of updating sender behavior values comprises the steps of: 

reducing said behavior trace table value by a decay factor (column 21, lines 45- 
67; column 21, table 3; the offset value has a decay factor +1)\ and 

adding a current behavior trace table value to said corresponding reduced 

behavior trace table value {column 21, lines 45-67; column 21, table 3). 

Regarding claim 32: Donaldson et al teach the method of claim 26 wherein said 
sender penalty count value is determined from undesirable sender activity occurring 
over a pre-established retention period (column 5, lines 52-58; note that the relay host 
will usually keep undelivered messages in its queue for up to a week). 

Regarding claim 33: Donaldson et al teach the method of claim 32 wherein said 
undesirable activity comprises a member of the group consisting of: 

sending a large number of e-mails (column 1 , lines 14-20), sending e-mails of 
relatively large sizes (column 1, lines 17-19), using a relatively large amount of TCP 
connection time (column 26, lines 1-11), and causing a TCP timeout (column 5, line 52- 
54; column 33, lines 20-23; note the occurrence of the interrupted TCP connection). 
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Regarding claim 34: Donaldson et al teach the method of claim 26 further 
comprising the step of updating said sender penalty count value (column 21, lines 12- 
15). 

Regarding claim 37: Donaldson et al teach the method for by a communication 
device for determining the disposition of incoming e-mail from a sender (column 2, lines 
37-41; fig. 1, items 1045-1048), said method comprising steps of: 

establishing an identity of the sender (column 6, lines 14-20; column 14, lines 63- 
67; fig. 14, items 1401-1406)] 

determining a penalty count value associated with said identity, wherein said 
cumulative penalty count is based on a behavior of the sender (column 23, lines 25-36; 
column 22, lines 25-33; fig. 16, items 1500-1518; note that the penalty count value here 
is the threshold number points or the matching count)] 

retrieving a system resource usage status associated with the communication 
device (column 6, lines 42-52)] and 

processing the incoming e-mail based on the penalty count value and the system 
resource usage status (column 22, lines 28-33; column 16, 12-19). 

Regarding claim 38: Donaldson et al teach the method of claim 37, wherein 
said step of establishing the identity of the sender comprises the step of ascertaining an 
IP address of the sender (column 6, lines 14-20). 
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Regarding claim 39: Donaldson et al teach the method of claim 37, wherein 
said step of determining a cumulative penalty count value comprises the step of 
assessing a penalty count value to said sender identity based on an undesirable activity 
performed by the sender( column 22, lines 23-33). 

Regarding claim 40: Donaldson et al teach the method of claim 37, wherein 
said cumulative penalty count value comprises a prior penalty count value reduced by a 
decay factor( column 21, lines 12-56; note that the filter scans the node name of the 
remote host for certain sequences and adds or subtracts points). 

Regarding claim 41: Donaldson et al teach the method of claim 37 wherein said 
step of processing the incoming e-mail comprises the step of assigning an operating 
state to the communication device, said operating state being a function of said system 
resource usage status (column 16, lines 12-19). 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

6. Claims 11-13, 17, 42-44, and 48 are rejected under 35 U.S.C 102(e) as being 
unpatentable over Donaldson, in view of Munger et al (Munger), U.S. 6,502,135 B1). 
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Regarding claims 11 and 42, Donaldson teaches the invention substantially as 
claimed. Donaldson discloses a method, wherein said operating state is a member of 
the group consisting of a normal operating state (column 16, lines 15-19), and a 
selective-rejection operating state (column 14, lines 63-67, column 15, lines 1-2), but 
fails to specifically disclose a random-rejection operating state. 

In the same field of endeavor, Munger discloses (..a random sync values that 
feed a random number generator, to prevent spooling attacks using a hashing 
technique of a time stamp or sequence number, and to establish the concept of future 
and past states while validating or rejecting the incoming packets in a network device...) 
[see Munger, column 26, lines 14-45\. 

Accordingly, it would have been obvious to one of ordinary skill in the networking 
art at the time the invention was made to have incorporated Munger's teachings of the 
random rejection of incoming packets, with the teachings of Donaldson, for the purpose 
of " getting advantage of quickly rejecting packets from unauthorized users such as 
hacker computer 3705... " as stated by Munger in lines 25-36 of column 45. By this 
rationale claims 11 and 42 are rejected. 

Regarding claims 12 and 43, the combination Donaldson-Munger teaches a 
method wherein, for said selective-rejection state, if said cumulative penalty count value 
has a zero value, said step of processing the incoming e-mail comprises the step of 
accepting the incoming e-mail [see column 17, lines 38-67\. The same motivation that 
was utilized in the combination of claims 1 1 and 42, applies equally as well to claim 12 
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and 43 [see Munger, column 45, lines 25-36]. By this rationale claims 12 and 43 are 
rejected. 

Regarding claims 13 and 44: the combination Donaldson-Munger teaches a 
method wherein, for said selective-rejection state, if said cumulative penalty count value 
has a nonzero value [see Donaldson, column 22, lines 34-62], said step of processing 
the incoming e-mail comprises the steps of: specifying a rejection factor; generating a 
random number; and randomly rejecting the incoming e-mail on the basis of said 
rejection factor and said random number [see Munger, column 28, lines 5-67, column 
29, lines 1-64\. The same motivation that was utilized in the combination of claims 1 1 
and 42, applies equally as well to claim 13 and 44 [see Munger, column 45, lines 25- 
36], By this rationale claims 13 and 44 are rejected. 

Regarding claims 17 and 48: the combination Donaldson-Munger teaches a 
method wherein if said cumulative penalty count value has a zero value [see 
Donaldson, column 17, lines 59-67], said step of processing the incoming e-mail 
comprises the steps of: deriving a resource usage factor; generating a random number; 
and randomly rejection the incoming e-mail on the basis of said resource usage factor, 
said random number, and said cumulative penalty count value [see Munger, column 28, 
lines 5-67, column 29, lines 1-64]. The same motivation that was utilized in the 
combination of claims 1 1 and 42, applies equally as well to claim 1 7 and 48 [see 
Munger, column 45, lines 25-36], By this rationale claims 17 and 48 are rejected. 
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7. Claim 29 is rejected under 35 U.S.C. 102(e) as being unpatentable over 
Donaldson in view of Barchi et al (Barchi), U.S. Patent No. 6,507,866 B1 . 

Regarding claim 29: Donaldson teaches the invention substantially as claimed. 
Donaldson discloses the method of claim 28 wherein said sender behavior values 
include a member of the group consisting of: the number of e-mails (column 32, lines 
41-47; note that the number of recipient here represents the number of emails), and 
total time of TCP connection time (column 14, lines 43-47), but does not teach how a 
sender behavior values includes the total size of e-mails. 

In the same field of endeavor, Barchi et al teaches a step to define a sample 
email filtering system "to include all e-mail messages that are tracked by unexpired 
records within the list, where N is a predetermined integer [see Barchi, column 9, lines 
7-35]. 

Accordingly, it would have been obvious to one of ordinary skill in the networking 
art at the time the invention was made to have incorporated Barchi's teachings of 
sender behavior including values expressing the totals size of tracked e-mails, with the 
teachings of Donaldson, for the purpose of " reducing or eliminating the volume of 
undesired e-mail messages received by a computer system or a server ..." as stated by 
Barchi in lines 25-36 of column 1 . By this rationale claim 29 is rejected. 
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Response to Arguments 

8. Applicants Request for Reconsideration filed on November 29 th , 2004 has been 
carefully considered but is not deemed fully persuasive. However, because there exists 
the likelihood of future presentation of this argument, the Examiner thinks that it is 
prudent to address Applicants' main points of contention. 

A. Independent claims 1, 20, 24, and 26 are allowable over Donaldson. 

1 . Namely applicant suggests that Donaldson does not teach or suggest a 
penalty count as claimed. 

2. As to claims 20 and 24, applicant points out that Donaldson does not 
teach a resource usage value. 

3. Namely applicant suggests that the Office action cherry picks portions 
of Donaldson in an attempt to make Donaldson appear as if it is anticipatory 
reference when, in fact it is not. 

B. Applicant contends that dependent claims 2-10, 21-23, 25, 27, 28, 30, and 
32-34 are allowable at least based on the allowability of their respective base 
claims. 

1 . With respect to claim 5, Donaldson does not teach or suggest both an 
activity penalty count and a time-dependent count. 

2. With respect to claim 6, Donaldson does not teach or suggest said 
time-dependent penalty count comprises a zero value subsequent to a pre- 
established retention. 
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3. With respect to claim 7, Donaldson does not teach or suggest the use 
of a decay factor to reduce the penalty count. 

C. Applicant contends that claims 11-13 rejection over Donaldson in view of 
Munger is respectfully traversed, because there is no motivation or suggestion to 
combine Donaldson with Munger. 

D. Applicant contends that claim 29 rejection is respectfully traversed , and is 
allowable at least based on the allowability of its respective base claim. 

E. Applicant contends that new claims 37-50, added to this amendment are 
allowable and that no new matter has been added. Applicant notes the indication 
of allowable subject matter in claims 14-19, 31 , 35, and 36. 

9. As to " Point A-1 " it is the position of the Examiner that Donaldson in detail 
teaches the limitations of the above-mentioned claims. However, in view of Applicant's 
remarks, stating that Donaldson does not disclose a penalty count , Applicant's 
arguments are deemed moot in view of the new grounds of rejection as explained 
above [see Donaldson, column 23, lines 25-36; column 22, lines 25-33; fig. 16, items 
1500-1518; note that the penalty count value here is the threshold number points or the 
matching counf\. Applicant suggests that on page 12 of his/her remarks that the 
Donaldson indicates that its matching points are point required to characterize the 
remote host as a dialup". The examiner interprets Donaldson as disclosing the dialup 
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as an example to determine "a type of source, or sender " required to characterize the 
remote host and its behavior [see Donaldson column 22, lines 23-26], 

As to " PointA-2 ", it is also the Examiner's position that at Col. 16, lines 12-29, 
Donaldson teaches a resource usage status by specifying internal states variables that 
are set or reset to indicate that resources have been deallocated. 

As to " Point A-3 ", it is the Examiner's position that this Office Action is in 
conformity with the MPEP rules and regulations as it demonstrates that this application 
does not point out the claimed patentable novelty with respect to Donaldson. In fact 
Donalson discloses a method and an apparatus to handle and filter junk emails similarly 
to this application. Examiner concludes there was no cherry picking of Donaldson in 
addressing the claims of this application. 

As to " points B-1 and B-2 ", it is also the Examiner's position that Donaldson 
suggests a result zero as a penalty count that matches a particular filter with respect to 
subsequent pre-establishes conversion of values based on optional textual information 
such as the filter date creation [see Donaldson, page 17, column 49-67]. 

As to " point B-3 ". it is also the Examiner's position that Donaldson discloses the 
use of a decay factor by subtracting 2 from the match count or the penalty count and 
closing the test connection [see Donaldson, column 25, lines 37-64]. 

As to " point C " it is the examiner's position that there is sufficient motivation or 
suggestion to combine Donaldson with Munger to reject claims 11-13 over Donaldson in 
view of Munger [see rejection of claims 11-13 above]. 
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As to " point D " it is the examiner's position that Applicant contention that "claim 
29 rejection is respectfully traversed , and that it is allowable at least based on the 
allowability of its respective base claim" as no basis and claim 29 stands rejection [see 
rejection above]. 

As to " point E " it is the examiner's position that Applicant contention that new 
claims 37-50, added to this amendment are allowable" has no solid ground and new 
claims 37-50 are rejected with the exception of claims 45-47, and 49-50, which are 
similar to previously allowable claims. In addition, claim 17, previously allowable has 
been rejected based on new grounds. New set of claims with allowable subject matter 
are as follow: 14-16, 18-19, 31, 35-36, 45-47, and 49-50. 

Examiner notes with delight that no new matter has been added and that the new 
claims are supported by the application as filed. However, applicant has failed in 
presenting claims and drawings that delineate the contours of this invention as 
compared to the cited prior art. Applicant has failed to clearly point out patentable 
novelty in view of the state of the art disclosed by the references cited that would 
overcome the 102(e) anticipation and the 103(a) rejections applied against the claims, 
the rejection is therefore sustained. 
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Conclusion 



10. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE NON-FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

1 1 . Any inquiry concerning this communication or earlier communications from 
examiner should be directed to Jude Jean-Gilles whose telephone number is (571) 272- 
3914. The examiner can normally be reached on Monday-Thursday and every other 
Friday from 8:00 AM to 5:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley, can be reached on (571) 272-3923. The fax phone number for 
the organization where this application or proceeding is assigned is (703) 305-3719. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is (703) 305- 
3900. 

Jude Jean-Gilles 
Patent Examiner 
Art Unit 2143 



JJG 



March 17, 2005 




